Host-only 10.99.0.0/24 bridge with no uplink/NAT; firewall drops VM
traffic leaving the bridge so unikernel VMs can reach only the gateway
(mc-proxy). Implements Phase 2 mandatory-mediation networking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Override the shared mcp.nix sandbox (PrivateDevices) on straylight so the
MCP agent can boot Nanos unikernel VMs under QEMU/KVM and manage TAP
devices for isolated networking.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add configs/mcp.nix (mcp user UID 850 + mcp-agent service) and open
firewall ports for DNS/mc-proxy/agent/master as straylight takes over
the master + MCIAS + MCNS core role from rift.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Kyle IsomandClaude Opus 4.8